# US 12,113,929 B2 · Systems and methods for detecting and/or preventing vishing attacks using user-generated authentication information

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,929 B2
- Document ID: US12113929B2
- Status: Granted
- Kind: B2
- Application number: 17/661,776
- Filed: 2022-05-03
- Published: 2023-11-09
- Granted: 2024-10-08
- Earliest claimed: 2022-05-03
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Jennifer Kwok; Dwij Trivedi; Abhay Donthi; Leeyat Bracha Tessler; Salik Shah
- Web page: https://patentgrep.com/patent/US12113929B2

## CPC

- H04M 3/382: {using authorisation codes or passwords}
- H04M 3/42034: {Calling party identification service}
- H04M 2203/60: related to security aspects in telephonic communication systems
- H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08)

## Abstract

A computer-implemented method for authenticating a source of a telephone call to a recipient of the telephone call may include receiving, prior to receiving the telephone call, a request to input first authentication information. The first authentication information may include a passcode or a selection of a security question. The method may include receiving input of the first authentication information and sending, by the user device, the first authentication information to a computing device associated with the source of the telephone call. The method may include receiving the telephone call from the source and receiving input from the recipient of the telephone call to answer the telephone call. The method may include receiving second authentication information from the computing device, where the second authentication information may include the passcode or an answer to the security question. The method may include outputting the second authentication information.

## Claims

### Claim 1

A computer-implemented method for authenticating a source of a telephone call to a recipient of the telephone call, comprising:
receiving, by a user device associated with the recipient of the telephone call and prior to receiving the telephone call, a request to input first authentication information,
wherein the first authentication information comprises a passcode or a selection of a security question;
receiving, by the user device, input of the first authentication information;
sending, by the user device, the first authentication information to a computing device associated with the source of the telephone call;
receiving, by the user device, the telephone call from the source;
receiving, by the user device, input from the recipient of the telephone call to answer the telephone call;
receiving, by the user device, second authentication information from the computing device,
wherein the second authentication information comprises the passcode or an answer to the security question; and
outputting, by the user device, the second authentication information.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the receiving of the input of the first authentication information further comprises:
receiving the input of the first authentication information via at least one of:
an input device of the user device, or
an application installed on the user device.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, further comprising:
outputting the request via an application installed on the user device as a push notification after receiving the request.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein the outputting of the second authentication information further comprises:
outputting the second authentication information via at least one of:
an output component of the user device, or
an application installed on the user device as a push notification.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising:
requesting, via an application installed on the user device and prior to receiving the second authentication information, input of third authentication information from the recipient of the telephone call after answering the telephone call, wherein the third authentication information comprises at least one of:
a password,
a unique identifier for the recipient, or
a biometric input.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, further comprising:
receiving, by an application installed on the user device, information related to a subject matter of the telephone call prior to receiving the request to input the first authentication information; and
determining, by the application, the first authentication information to be requested based on a security preference set in the application.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein the request further comprises information related to the source of the telephone call.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, wherein the second authentication information comprises the information related to the source of the telephone call.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, wherein the first authentication information is based on historical activity information related to the recipient of the telephone call.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1, further comprising:
receiving input that the second authentication information is correct via at least one of:
an input device of the user device, or
an application installed on the user device; and
providing the input that the second authentication information is correct to the computing device associated with the source of the telephone call.

### Claim 11 (depends on 1)

The computer-implemented method of claim 1, further comprising:
receiving input that the second authentication information is incorrect via at least one of:
an input device of the user device, or
an application installed on the user device; and
terminating the telephone call based on the input that the second authentication information is incorrect.

### Claim 12

A user device, comprising:
at least one memory storing instructions; and
at least one processor executing the instructions to perform operations for authenticating a source of a telephone call to a recipient of the telephone call, the operations including:
receiving, prior to receiving the telephone call, a request to input first authentication information,
wherein the first authentication information comprises a passcode or a selection of a security question;
receiving input of the first authentication information;
sending the first authentication information to a computing device associated with the source of the telephone call;
receiving the telephone call from the source;
receiving input from the recipient of the telephone call to answer the telephone call;
receiving second authentication information from the computing device,
wherein the second authentication information comprises the passcode or an answer to the security question; and
outputting, by the user device, the second authentication information.

### Claim 13 (depends on 12)

The user device of claim 12, wherein the receiving of the input of the first authentication information further comprises:
receiving the input of the first authentication information via at least one of:
an input device of the user device, or
an application installed on the user device.

### Claim 14 (depends on 12)

The user device of claim 12, wherein the operations further comprise:
outputting the request via an application installed on the user device as a push notification after receiving the request.

### Claim 15 (depends on 12)

The user device of claim 12, wherein the outputting of the second authentication information further comprises:
outputting the second authentication information via at least one of:
an output component of the user device, or
an application installed on the user device as a push notification.

### Claim 16 (depends on 12)

The user device of claim 12, wherein the operations further comprise:
requesting, via an application installed on the user device and prior to receiving the second authentication information, input of third authentication information from the recipient of the telephone call after answering the telephone call, wherein the third authentication information comprises at least one of:
a password,
a unique identifier for the recipient, or
a biometric input.

### Claim 17 (depends on 12)

The user device of claim 12, wherein the operations further comprise:
receiving, by an application installed on the user device, information related to a subject matter of the telephone call prior to receiving the request to input the first authentication information; and
determining, by the application, the first authentication information to be requested based on a security preference set in the application.

### Claim 18 (depends on 12)

The user device of claim 12, wherein the request further comprises information related to the source of the telephone call.

### Claim 19 (depends on 12)

The user device of claim 12, wherein the first authentication information is based on historical activity information related to the recipient of the telephone call.

### Claim 20

A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method for authenticating a source of a telephone call to a recipient of the telephone call, the method comprising:
receiving, prior to receiving the telephone call, a request to input first authentication information,
wherein the first authentication information comprises a passcode or a selection of a security question;
receiving input of the first authentication information;
sending the first authentication information to a computing device associated with the source of the telephone call;
receiving the telephone call from the source;
receiving input from the recipient of the telephone call to answer the telephone call;
receiving second authentication information from the computing device,
wherein the second authentication information comprises the passcode or an answer to the security question; and
outputting the second authentication information.